Publish curated EventLens source from a0b1324c0f3e54c1e9a26058aa2785f9487519bf

README.md

@@ -99,6 +99,12 @@ Open [http://localhost:1252](http://localhost:1252). The production image uses d
 
 For an Unraid DockerMan-managed Compose deployment, the compose metadata publishes the WebUI URL and serves the durable canonical icon locally at `/eventlens-icon-512.png` through `net.unraid.docker.webui` and `net.unraid.docker.icon`. A broker-managed deployment must preserve those service labels for DockerMan to import them; EventLens does not claim DockerMan lifecycle ownership.
 
+## Analyze your first event log
+
+Start with the deterministic demo to learn the timeline, filters and report controls without uploading incident data. For a real investigation, load an authorized EVTX file, inspect the parser's completion status, narrow the time window and review the original evidence behind a correlation before exporting a report.
+
+An empty filtered timeline does not establish that nothing happened. Check the selected interval, event filters and parse/truncation status. Review redacted exports before sharing them: best-effort redaction is not a guarantee that every identifying value has been removed.
+
 ## Validation
 
 The release gates are reproducible from a clean checkout: